A QR code is just a pattern of dots. Nobody can tell by looking where it leads, and scammers count on that. Here are the common tricks and a few habits that keep you safe.
Common tricks
- A sticker over the real code. A new code pasted on a payment sign or poster takes seconds, and your money or details go to someone else.
- Look-alike websites. A fake bank, government or delivery login page with the right logo and colours. The giveaway is the address: a near-miss spelling, or the real name placed in front of someone else's domain.
- Urgent letters, messages and e-mails. "Overdue bill", "parcel held", "refund today". Pressure to act fast is the warning sign.
- App installs. Some codes lead to an app download outside the official app stores. Install apps from the official stores only.
- Swapped payment codes. A PromptPay code that pays someone else the moment you confirm.
The one rule
Never type a password, OTP code, PIN or card number into a page you opened from a QR code, however real it looks. To sign in to your bank or an agency, open its official app or type the address you know. An OTP is for you alone: never give it to anyone, whoever they claim to be.
Check a link before you open it
Many phone cameras show the address before you tap; read it every time. For a closer look, use the QR reader:
- Open the QR reader and press "Open camera", choose a picture or screenshot, or paste a copied image.
- Read the Website line (the site the link goes to) and the Page line (the rest of the address).
- Nothing opens until you press the "Open" button with the site name on it.
- For an unencrypted http link, the reader warns you not to enter passwords or card details.
The reader works on your device and uploads nothing, so it suits codes people send you in chat.
Reading an address
The real owner is at the end of the Website line. If it says yourbank.co.th.example.com, the site belongs to example.com, not your bank. Watch for look-alike spellings too, such as the letter o and the digit 0.
If the Website line shows a link shortener or a QR service, the destination stays hidden until you open it; QRnaka's tracked codes work that way too. If you open it, read the browser's address bar before typing anything.
The reader shows where a link goes. It cannot tell you whether the site is honest.
Before paying with PromptPay
The reader shows the PromptPay number the money goes to, and the amount if there is one, but not the owner's name. The real name appears only in your banking app after you scan, so compare it with the shop or person you mean to pay before confirming, every time.
A fake code made from scratch passes the CRC check, so that check alone proves nothing. The full method is in Check a PromptPay QR before paying.
For shops with QR codes on display
- Check your signs regularly for stickers or raised edges.
- Scan them with the QR reader to confirm the PromptPay number or website is still yours.
- Keep signs where staff can see them, and print the account name for customers to compare; see PromptPay payment signs.
Found a dangerous QRnaka code?
The report page is only for codes made with QRnaka, the ones whose Website line in the reader shows our site. It is not a reporting service for every QR code.
- Scan the code with the QR reader and copy the link.
- Open the report page, paste it and choose a reason, such as phishing, payment scam or gambling.
- Add details or a contact if you like, and send.
The team checks and blocks it, and under our terms a link suspended for review shows a warning page instead of its destination. For codes from other services, report to whoever provides them.
If it already happened
- You typed a password: change it now through the official app or site, and tell the bank or provider.
- You paid a scammer: as our report page says, call your bank now and report at thaipoliceonline.go.th or call 1441. The sooner, the better.
FAQ
Is just scanning a code dangerous?
Scanning only reads the data. Most of the risk comes next: opening the link and typing something, installing an app, or confirming a payment.
Can the QR reader spot a fake code?
No. It shows where a code leads or which PromptPay number it pays. Judging whether that is genuine is up to you.
Can I report any QR code to you?
No, only codes made with QRnaka.
Next time you are unsure, open the QR reader first. It takes seconds.
